linux/meta-openembedded.git/meta-oe/recipes-support/poppler, branch kirkstone

poppler: mark CVE-2022-38171 patched

2026-02-15T14:30:54+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2022-38171 This is the same as CVE-2021-30860, but that one was primarily filed against Apple software (and some other related projects). The patch that fixes this vulenrability is already added to the recipe, just extend its CVE tag Signed-off-by: Gyorgy Sarvari

poppler: fix CVE-2025-52885

2025-10-17T08:51:27+00:00

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-52885 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0 Signed-off-by: Yogita Urade Signed-off-by: Gyorgy Sarvari

poppler: fix CVE-2025-43718

2025-10-17T08:51:27+00:00

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor). Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43718 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408 Signed-off-by: Yogita Urade Signed-off-by: Gyorgy Sarvari

poppler: fix CVE-2025-52886

2025-09-06T14:27:59+00:00

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. CVE-2025-52886-0001 and CVE-2025-52886-0002 are dependent commits while rest are actual CVE fixes. References: https://nvd.nist.gov/vuln/detail/CVE-2025-52886 https://security-tracker.debian.org/tracker/CVE-2025-52886 Upstream patches: https://gitlab.freedesktop.org/poppler/poppler/-/commit/d35e11a8f84d396a9d9ef43ef852d377adc3830a https://gitlab.freedesktop.org/poppler/poppler/-/commit/af3e1e1a3577c4e1c66cbe69ebdc6a632038e299 https://gitlab.freedesktop.org/poppler/poppler/-/commit/3449a16d3b1389870eb3e20795e802c6ae8bc04f https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5 Signed-off-by: Yogita Urade Signed-off-by: Gyorgy Sarvari

poppler: fix CVE-2025-50420

2025-09-06T14:27:30+00:00

An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS). Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-50420 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/a7025904e3330dd6cf95f3664ef6fc77034cc5e1 Signed-off-by: Yogita Urade Signed-off-by: Gyorgy Sarvari

poppler: fix CVE-2025-43903

2025-05-25T18:48:44+00:00

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43903 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

poppler: fix CVE-2025-32365

2025-05-25T18:48:33+00:00

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32365 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/1f151565bbca5be7449ba8eea6833051cc1baa41 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

poppler: fix CVE-2025-32364

2025-05-25T18:48:23+00:00

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32364 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

poppler: fix CVE-2024-56378

2025-01-23T00:16:49+00:00

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56378 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

poppler: fix CVE-2024-6239

2025-01-23T00:16:45+00:00

A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. CVE-2024-6239-0001 is the dependent commit and CVE-2024-6239-0002 is the actual CVE fix. fix indent issue in poppler_22.04.0.bb file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-6239 Upstream patches: https://gitlab.freedesktop.org/poppler/poppler/-/commit/0554731052d1a97745cb179ab0d45620589dd9c4 https://gitlab.freedesktop.org/poppler/poppler/-/commit/fc1c711cb5f769546c6b31cc688bf0ee7f0c1dbc Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster